FreeSpeech AAC Privacy Policy

Version 2026-09-29 · Effective 29 September 2026

FreeSpeech AAC (freespeechaac.com) is a free augmentative and alternative communication (AAC) web app. It is run by Archer Calder, an individual developer in Houston, Texas, USA. I am responsible for your information and act as the privacy officer. Contact: [email protected].

Who uses FreeSpeech

Accounts are for adults: parents and caregivers, teachers, speech-language pathologists, schools, and adult AAC users. Children and other people may use boards that an account holder sets up, but children should not create their own accounts. If you set up FreeSpeech for a child, you confirm that you are their parent or guardian, or that you have the parent's or school's authorization.

Schools. A school may consent on parents' behalf for educational use. In that case I use students' information only to provide FreeSpeech to the school, and for no other commercial purpose. On request, a school can get a description of the information held, review it, have it deleted, and stop further collection.

What I collect

Account information

• Email address and name.
• A password, stored only as a bcrypt hash. If you use Google sign-in, I receive your name, email address and profile picture from Google and do not need a password.
• An optional profile image.

Boards and content

• Boards, pages and tiles, including their text and images.
• Images you upload.
• This content can include a child's personal vocabulary, names and photos, and can reveal disability or health information. I treat it as sensitive and use it only to run the service for you.

ElevenLabs API key (optional)

• If you add your own ElevenLabs key, I store it encrypted.

Server logs

• The web server's access logs record IP addresses and requested addresses, including image search terms. They are kept for about 14 days.
• Application logs record only the request method and path.

Settings kept only on your device

• Voice, PIN, behavior settings and offline copies of boards are stored in your browser's storage and are not sent to me.
• Clearing your browser's site data removes them.
• The PIN is a convenience lock, not strong security.

You need an email address and either a password or Google sign-in to create an account. Everything else is optional.

How information is collected

• Directly from you when you create an account and build boards.
• From Google, if you choose Google sign-in.
• Automatically in server logs when your browser contacts FreeSpeech.

How I use it

I use your information to:

• sign you in and keep your account secure
• store, sync and show your boards
• send password-reset emails
• turn text into speech when you enable cloud voices
• search for symbols and images
• remove image backgrounds when you ask
• fix problems and protect against abuse
• answer your requests, and tell you about changes or security incidents

I do not:

• use analytics or advertising
• sell data or share it for marketing
• send marketing email
• build profiles
• use your information to train AI or language models

Who receives information

I share information only with the services below, only as needed to run FreeSpeech, or when the law requires it.

Service	What it receives	Why	Where
DigitalOcean (digitalocean.com)	All account and board data, logs, database backups	Server hosting	San Francisco, USA
Cloudflare (cloudflare.com)	All traffic passing through, uploaded images (R2 storage)	Content delivery, security, image storage	USA; global network
Google (google.com)	Your Google identity at sign-in	Google sign-in, only if you choose it	USA and other countries
Resend (resend.com)	Your email address and the reset link	Sending password-reset email	USA
ElevenLabs (elevenlabs.io)	Text to be spoken	Cloud voices, only if you turn them on	USA
Brave Search (brave.com) and OpenSymbols (opensymbols.org)	Image and symbol search terms	Finding images and symbols	USA
fal.ai (fal.ai)	Images you choose for background removal	Background removal	USA

Images linked from other websites. Some board images load directly from other websites. When a board shows such an image, that website receives the viewer's IP address and browser details, and its own privacy policy applies.

Storage outside your country

FreeSpeech is hosted in the United States. If you are in Australia, New Zealand or elsewhere outside the USA, your information is sent to and stored in the United States, and is handled by the services listed above. I will give advance notice before moving hosting, or anyone with access to your data, to another country.

Security

I protect your information by:

• encrypting connections with HTTPS
• hashing passwords with bcrypt
• storing ElevenLabs keys encrypted
• limiting administrative access to the servers to named, trusted people
• limiting each account's data to that account

No system is perfectly secure. Please use a strong password.

How long I keep information

• Account, boards and images: kept while your account exists. Deleted when you delete your account, or when you ask me to delete them.
• Deleted data in backups: database backups are kept for up to 7 days, so deleted data is gone from backups within that time.
• Server logs: about 14 days.
• Password-reset links: expire after one hour.
• Inactive accounts: kept until you delete them or ask me to. I don't delete inactive accounts automatically.

Your rights and choices

• Access and export: download all your data as a JSON file on your Profile page.
• Correction: edit your account and boards at any time, or ask me to correct something.
• Deletion: delete your account on your Profile page. This removes your account, boards and uploaded images.
• Requests: email [email protected].
  • Requests are free and I'll respond within 30 days.
  • I may need to confirm you own the account.
  • Parents, and schools that authorized use, can ask to review or delete a child's information.

Complaints

Email me first and I'll respond within 30 days. If you are not satisfied, you can complain to your privacy regulator:

• Australia: the Office of the Australian Information Commissioner (oaic.gov.au).
• New Zealand: the Office of the Privacy Commissioner (privacy.org.nz).

Data breaches

If a security incident affects your information, I will promptly notify:

• affected account holders
• relevant schools and education authorities
• regulators, where the law requires it

The notice will say what happened, what information was involved and what you can do.

Changes to this policy

For material changes, I will email account holders at least 30 days before the change takes effect. Each version is dated. Earlier versions are available on request.